Re: Microsoft IKE DoS... source port 500?

From: Crist J. Clark (cristjc@earthlink.net)
Date: 01/01/02 

Date: Mon, 31 Dec 2001 22:10:33 -0500
From: "Crist J. Clark" <cristjc@earthlink.net>
To: "Abe L. Getchell" <abegetchell@home.com>

On Sat, Dec 29, 2001 at 06:26:14PM -0500, Abe L. Getchell wrote:
[snip]

> (from http://www.ietf.org/rfc/rfc2408.txt)
>
> 2.5.1 Transport Protocol
>
> ISAKMP can be implemented over any transport protocol or over IP
> itself. Implementations MUST include send and receive capability for
> ISAKMP using the User Datagram Protocol (UDP) on port 500. UDP Port
> 500 has been assigned to ISAKMP by the Internet Assigned Numbers
> Authority (IANA). Implementations MAY additionally support ISAKMP
> over other transport protocols or over IP itself.
>
> Notice that this doesn't specify that IKE packets _must_ have a source
> port of 500, it simply says 'port 500'. Can someone point me to any
> piece of documentation which specifies that IKE packets _must_ have a
> source port of 500? Is this one of those 'unofficial standards' and
> hence the reason for Microsoft's implementation processing these packets
> as normal?

IMHO, demanding that IKE datagrams have a source port of 500 is the
"more buggy" behavior. The RFC says you must be able to "receive on"
and "send on" port 500. It does not say anything about the port we
"send to" or "receive from." 

-- 
"It's always funny until someone gets hurt. Then it's hilarious."

Crist J. Clark                     |     cjclark@alum.mit.edu
                                   |     cjclark@jhu.edu
http://people.freebsd.org/~cjc/    |     cjc@freebsd.org

Relevant Pages

  • Re: urgent: RELENG_5 ipfw/nat/IPSEC Problem..
    ... > allowing udp connections from inside to the outside net and vis versa is'nt ... FreeBSD NAT firewall was to tell it not to NAT the source port of the ... isakmp packets, as isakmps need to have source and destination port 500. ...
    (freebsd-net)
  • cannot use Nortel vpn with ADSL router ?
    ... The router has NAT enabled and serves as the DHCP ... I opened up port 500 to allow ISAKMP traffic - this got me past ... I continue to see ISAKMP informational packets ...
    (comp.security.firewalls)
  • RE: Port 500??
    ... Subject: Port 500?? ... That's ISAKMP. ... Lately I've seen alot of probing on the firewall logs with UDP 500 as ... =IkJY ...
    (Security-Basics)
Quantcast